This faulty WordPress plugin could allow hackers to wipe your website

Researchers have uncovered two severe vulnerabilities in the PageLayer WordPress plugin that could allow hackers to hijack websites that employ its design features.

The affected plugin is used to build custom web pages via a simple drag-and-drop mechanism - a boon for users without programming expertise - and is deployed across more than 200,000 websites.

Identified by security firm Wordfence, the two bugs could also be manipulated by cybercriminals to inject rigged code, meddle with existing website content, and even perform a total content erasure.

WordPress plugin bugs

According to the researchers responsible for the discovery, the pair of vulnerabilities stem from unprotected AJAX actions, nonce disclosure, and a lack of measures to safeguard against Cross-Site Request Forgery (CSRF).

Hackers could reportedly exploit these oversights to perform all manner of malicious activities, including creating admin accounts, funnelling visitors to dangerous domains and invading a user’s computer via the web browser.

“One flaw allowed any authenticated user with subscriber-level and above permissions the ability to update and modify posts with malicious content, amongst many other things,” explained Wordfence.

“A second flaw allowed attackers to forge a request on behalf of a site’s administrator to modify the settings of the plugin which could allow for malicious Javascript injection.”

The security firm disclosed the flaws on April 30 and PageLayer subsequently issued a patch on May 6, with version 1.1.2. However, despite three weeks having passed since the patch was issued, only roughly 85,000 users have updated to the latest version, leaving circa 120,000 still at risk.

To safeguard against site takeover, PageLayer users are advised to update the plugin to the latest version immediately.

Check out our list of the best WordPress plugins of 2020

Via Bleeping Computer

from TechRadar - All the latest technology news https://ift.tt/2XHQi9n

The best cheap PS4 bundles, deals and prices in the November sales

Black Friday sales are coming thick and fast and with the weekend's excellent PS4 bundle deals still in stock you'll be happy to find some amazing prices on the Slim and Pro models this week - and we've rounded them up in our Black Friday PS4 deals page for you too. If you're looking for a cheap PS4 bundle deal, this week is a fantastic time to buy, with prices as low as £239 on the Slim and £290 on the Pro. You're in for a great time too, as so many of the best PS4 games are super cheap nowadays. You've got plenty of great titles to enjoy for far less than they originally sat on store shelves for, and over the Black Friday sales you'll have more than enough opportunity to take advantage of even lower game prices. Naturally, lots of the below PS4 bundles come with the hottest games. And yes, we've tracked down the new Limited Edition Days of Play PS4 for you too. We're on the hunt for the lowest PS4 prices all year round, so we aren't ea...

Technology Simplified

Search This Blog